comfyui-mcp 0.51.49 → 0.51.51

package/dist/orchestrator/download-done-guard.js

@@ -0,0 +1,94 @@
+/**
+ * #1574 — when the completion event and `download_model action:"status"` disagree, say so.
+ *
+ * The tray raised `transfer completed` for an 11.46GB download while
+ * `download_model action:"status"` reported it still streaming, `list_local_models` showed the
+ * file absent, and the category count only rose minutes later. The file landed AFTER the
+ * event.
+ *
+ * The completion event is built from a PROGRESS ROW read off disk each tick. `status` answers
+ * from the JOB RECORD. Two stores, and the event consults only one — the same split #1545
+ * documented from the other side.
+ *
+ * ## Why this ANNOTATES and never suppresses
+ *
+ * The first version of this dropped the contradicted event. Review killed it, correctly: a
+ * terminal record may legitimately still read `downloading` until the ~15s persistence
+ * heartbeat retries (see `persistDownloadJob`'s return value, #1545). The debounce bucket is
+ * deleted before filtering and never requeued, so suppressing on a lagging record would
+ * PERMANENTLY lose the completion notification for a download that genuinely finished.
+ *
+ * That trades a confusing message for a missing one, which is worse: the user is waiting on
+ * that event. So the event always fires, and a disagreement is disclosed on it. The harm in
+ * the report is a CONFIDENT false completion — "the natural next action is to use the file" —
+ * and a hedge is precisely what removes that.
+ *
+ * ## Identity
+ *
+ * The two stores do not share an id. A progress row's `id` is the progress/tray identity;
+ * the job's `id` is its public status handle (`6226e26ba97f8527` in the report, against tray
+ * `93015fbfa0fa9933`). The row is matched against the job's `progressId ?? trayId`, which is
+ * what writes those rows. An earlier version compared row id to job id and was therefore
+ * INERT — it never matched anything, and its unit tests missed that because they fed
+ * synthetic rows carrying whatever id the assertion wanted.
+ */
+/** The identity a PROGRESS ROW is written under. */
+function progressIdentityOf(job) {
+    const progress = typeof job.progressId === "string" ? job.progressId : null;
+    const tray = typeof job.trayId === "string" ? job.trayId : null;
+    return progress ?? tray;
+}
+/**
+ * Does the job record disagree with announcing this row as completed?
+ *
+ * True ONLY on a positive contradiction: a record exists for this exact progress identity and
+ * still says `downloading`. A missing record is not evidence — the record store resets on an
+ * orchestrator respawn, which is exactly the reported session.
+ */
+export function completionDisagreesWithRecord(row, jobs) {
+    if (!row || typeof row !== "object")
+        return false;
+    // Only COMPLETIONS. A failure event carries its own hedged wording (#1150) and must be
+    // left entirely alone.
+    if (row.status !== "done")
+        return false;
+    const id = typeof row.id === "string" ? row.id : null;
+    if (!id)
+        return false;
+    if (!Array.isArray(jobs))
+        return false;
+    // (id, target) — the SAME key the supersession logic uses, and for the same reason: a
+    // concurrent LOCAL and POD transfer of one URL shares an id but is two transfers with two
+    // outcomes. Matching on id alone could annotate the wrong completion, or miss a real
+    // disagreement by finding the other one first (review).
+    //
+    // A target is compared only when BOTH sides carry one. Rows and records that predate the
+    // field, or a route that never sets it, must not silently stop matching — that would make
+    // the check inert again, which is exactly how the first version shipped.
+    const target = typeof row.target === "string" ? row.target : null;
+    const sameId = jobs.filter((j) => j && typeof j === "object" && progressIdentityOf(j) === id);
+    if (!sameId.length)
+        return false;
+    // PREFER THE EXACT (id, target) MATCH (review, round 3). Taking the first id match in
+    // array order let a TARGETLESS record shadow the exact one: a targetless "downloading"
+    // sitting before an exact-target "done" reported a disagreement that does not exist, and
+    // would have hedged a completion that was perfectly fine.
+    //
+    // The targetless record still stands in when nothing matches on target — that is what
+    // keeps rows and records predating the field from silently going unmatched, which would
+    // make the whole check inert again.
+    const record = (target ? sameId.find((j) => j.target === target) : undefined) ??
+        sameId.find((j) => typeof j.target !== "string") ??
+        (target ? undefined : sameId[0]);
+    if (!record)
+        return false;
+    return record.status === "downloading";
+}
+/** The disclosure appended to a completion the record disagrees with. Deliberately states
+ *  BOTH readings and what to do, rather than picking a winner this cannot establish. */
+export const COMPLETION_DISAGREEMENT_NOTE = "CAVEAT: `download_model action:\"status\"` still reports this transfer as downloading. " +
+    "The two are read from different stores and the record can lag a real completion by a few " +
+    "seconds, so this may simply be that — but a completion event has also been observed to " +
+    "arrive minutes before the file existed (#1574). Check `download_model action:\"status\"` " +
+    "and that the file is present before loading it.";
+//# sourceMappingURL=download-done-guard.js.map

package/dist/orchestrator/download-done-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"download-done-guard.js","sourceRoot":"","sources":["../../src/orchestrator/download-done-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAmBH,oDAAoD;AACpD,SAAS,kBAAkB,CAAC,GAAY;IACtC,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,OAAO,QAAQ,IAAI,IAAI,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,GAAY,EAAE,IAAwB;IAClF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,uFAAuF;IACvF,uBAAuB;IACvB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,sFAAsF;IACtF,0FAA0F;IAC1F,qFAAqF;IACrF,wDAAwD;IACxD,EAAE;IACF,yFAAyF;IACzF,0FAA0F;IAC1F,yEAAyE;IACzE,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,kBAAkB,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9F,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACjC,sFAAsF;IACtF,uFAAuF;IACvF,yFAAyF;IACzF,0DAA0D;IAC1D,EAAE;IACF,sFAAsF;IACtF,wFAAwF;IACxF,oCAAoC;IACpC,MAAM,MAAM,GACV,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;QAChD,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,MAAM,CAAC,MAAM,KAAK,aAAa,CAAC;AACzC,CAAC;AAED;wFACwF;AACxF,MAAM,CAAC,MAAM,4BAA4B,GACvC,yFAAyF;IACzF,2FAA2F;IAC3F,yFAAyF;IACzF,2FAA2F;IAC3F,iDAAiD,CAAC"}

package/dist/orchestrator/index.js

@@ -36,6 +36,8 @@ import { uploadImageHttp, resetClient } from "../comfyui/client.js";
 import { setConnectedPanelOrigins } from "../comfyui/fetch.js";
 import { publishConnectedPanelOrigins } from "../services/panel-origin-channel.js";
 import { logger } from "../utils/logger.js";
+import { listDownloadJobs } from "../services/download-jobs.js";
+import { completionDisagreesWithRecord } from "./download-done-guard.js";
 import { assembleVocabularyHash, describeVocabularySkew } from "../tools/vocabulary.js";
 import { buildPanelToolDefs } from "./panel-tools.js";
 /** The panel vocabulary hashes whose MISMATCH has already been reported (#236).
@@ -5225,13 +5227,23 @@ export async function runPanelOrchestrator() {
                     const key = resolveDownloadAgentKey(row);
                     if (key && manager.hasLiveAgent(key)) {
                         const bucket = downloadDonePending.get(key) ??
-                            { downloads: new Map(), flushAt: 0 };
+                            {
+                                downloads: new Map(),
+                                flushAt: 0,
+                            };
                         // Identify each pending download by its (id, target) supersession key — NOT
                         // the id alone: a concurrent LOCAL + POD transfer of the same URL shares an id
                         // but must produce TWO #547 outcomes, and the same key lets a newer attempt
                         // evict this entry above. Fall back to the file path when the row has no id.
                         const supKey = downloadAttemptKey(row) ?? ` ${full}`;
                         bucket.downloads.set(supKey, {
+                            // #1574 — CARRY THE ROW ID. Without it the record cross-check at the flush has
+                            // nothing to match a job against, silently agrees with everything, and the
+                            // whole disclosure is a no-op. That is exactly how the first version shipped.
+                            id: typeof row.id === "string" ? row.id : undefined,
+                            // (id, target) is the row identity — id alone collides for a concurrent
+                            // LOCAL + POD transfer of the same URL (review).
+                            target: typeof row.target === "string" ? row.target : undefined,
                             name: String(row.name ?? row.id ?? "model"),
                             status: String(status),
                             attempt: typeof row.attempt === "number" ? row.attempt : undefined,
@@ -5288,6 +5300,38 @@ export async function runPanelOrchestrator() {
             // filename, so the (id, target) eviction above cannot see it. The live rows
             // are already in hand this tick; markSupersededByLive asks them by name.
             markSupersededByLive(settled, downloads);
+            // #1574 — DROP a completion this orchestrator's own status tool would contradict.
+            //
+            // The event is built from the progress ROW; `download_model action:"status"` answers
+            // from the job RECORD. A reporter got "transfer completed" for an 11.46GB file while
+            // status said it was still streaming and the file was not on disk — it landed minutes
+            // later. Whatever wrote that row, the record is in hand right here.
+            //
+            // Only a POSITIVE contradiction drops it (the record exists, same id, still
+            // "downloading"). An absent record means nothing: the record store resets on a
+            // respawn, which is the reported session, and treating absence as in-flight would
+            // silence every completion after any respawn.
+            const records = (() => {
+                try {
+                    return listDownloadJobs();
+                }
+                catch {
+                    // Never let the guard break the event path — a completion we cannot check is
+                    // still a completion worth delivering.
+                    return [];
+                }
+            })();
+            // ANNOTATE, never suppress (review). A terminal record can legitimately still read
+            // "downloading" until the ~15s persistence heartbeat retries (#1545), and this bucket
+            // is deleted before this point and never requeued — so dropping the event here would
+            // permanently lose the completion for a download that genuinely finished. That trades
+            // a confusing message for a missing one, which is worse: the user is waiting on it.
+            const disagreeing = settled.filter((d) => completionDisagreesWithRecord(d, records));
+            for (const d of disagreeing)
+                d.recordDisagrees = true;
+            if (disagreeing.length) {
+                logger.warn("[panel-orchestrator] a download completion disagrees with the job record; disclosing rather than suppressing (#1574)", { ids: disagreeing.map((d) => String(d.id ?? "")) });
+            }
             // #884 — a download has no originating TAB (its row names the owning
             // conversation), so its turn INHERITS the conversation's LAST
             // ESTABLISHED origin — never the active tab (confirming gate 2, P0 rule: